How do you prepare for a HRSA 340B audit with your TPA?
Treat a HRSA audit as a records test you can rehearse. HRSA’s auditors check four things: eligibility (including your 340B OPAIS record), the GPO prohibition where it applies, duplicate discounts and diversion. You’ll get an engagement letter, then a Data Request List that asks for your policies, eligibility documents, purchasing accounts, contract pharmacy agreements, Medicaid billing proof and a “340B universe” of every drug dispensed or administered as 340B in the sample period. Your TPA supplies much of that universe and the claim-level history behind each sampled prescription. The covered entity still owns the answers, so keep OPAIS current, audit your contract pharmacies, and practice pulling a sample before the letter arrives.[1][3][6]
The four things HRSA tests
Every finding HRSA posts traces back to one of these statutory requirements. Noncompliance can lead to repayment to manufacturers or removal from the program.[1][2]
Eligibility
42 U.S.C. § 256b(a)(4)Is the entity, each registered site and each contract pharmacy eligible, and does 340B OPAIS match reality? For hospitals that means sites tied to the Medicare cost report; for grantees, sites in the grant scope.[1][3]
GPO prohibition
42 U.S.C. § 256b(a)(4)(L)(iii)Disproportionate share hospitals, children’s hospitals and cancer hospitals exempt from Medicare’s prospective payment system can’t buy covered outpatient drugs through a group purchasing organization. Auditors check purchasing accounts for it.[1][2][3]
Duplicate discounts are the most technical of the four. See 340B duplicate discounts and the Medicaid Exclusion File.
From engagement letter to closeout
- Selection
Engagement letter
HRSA emails the authorizing official listed in 340B OPAIS. Apexus notes selection draws on risk factors such as purchase volume, number of contract pharmacies and program complexity. Only one audit of an entity runs at a time, and HRSA can also let a manufacturer audit you.[1][5]
- Pre-audit
Introductory call and Data Request List
Auditors hold a teleconference to request policies, procedures and internal-control documents, then schedule an opening meeting with management. The Data Request List can be due as close as two weeks before fieldwork; one consulting firm puts the usual window at three to four weeks.[1][5][8]
- Pre-audit
Sample selection
Auditors pick transactions from your 340B universe to test. One firm reports the sample often arrives about three days before audit day and runs roughly 60 to 70 claims across contract pharmacy, entity-owned and mixed-use settings.[3][8]
- Fieldwork
Onsite or remote testing
Auditors review policies and how they work in practice, verify eligibility and OPAIS accuracy, check controls against diversion and duplicate discounts, and test sampled records. Remote audits use secure workspaces and Zoom. Auditors don’t share conclusions during fieldwork.[1]
- Post-audit
Final report
HRSA reviews the auditor’s preliminary report and issues a final report. You have 30 calendar days to send a written disagreement with documentation, or to accept it.[1]
- Post-audit
Corrective action and repayment
If you agree, the corrective action plan is due within 60 calendar days. HRSA expects it carried out, and manufacturer settlements finished, within six months of approval. Findings and sanctions are posted on HRSA’s website.[1][7]
HRSA may re-audit an entity. Repeating the same finding can bring more audits, and diversion found in two or more audits may be treated as systematic and egregious, which can mean removal from the program.[1][2]
The Data Request List, section by section
This follows the public sample from the 340B Prime Vendor Program, last updated September 10, 2026. HRSA’s actual request can differ. The last column is where the answer usually lives, so you know whom to ask.[3][4]
| # | Section | What it asks for | Usually comes from |
|---|---|---|---|
| 1 | Policies and procedures | Registration and recertification, OPAIS upkeep, site eligibility, procurement, GPO prevention, contract pharmacy oversight, virtual inventory, diversion and duplicate discount controls, self-disclosure.[3] | 340B program team |
| 2 | Eligibility documentation | Hospitals: IRS Form 990 or official ownership documents, Medicare cost reports, the trial balance and a crosswalk tying each site to its EHR location code. Grantees: notice of award and site forms.[3] | Finance and compliance |
| 3 | 340B universe | Every 340B drug furnished, administered or dispensed in the sample period, with a methodology table and a crosswalk of column headers.[3] | TPA and split-billing software, EHR |
| 4 | Provider list | Eligible providers with NPI, employed or contracted, and start and end dates.[3] | Credentialing or medical staff office |
| 5 | Purchasing | All wholesaler, direct and consignment accounts (active or inactive, pricing type, ship-to location), one invoice per account and a 340B purchase order list.[3] | Pharmacy purchasing, wholesaler reports |
| 6 | Contract pharmacies | Every contract pharmacy and whether it’s used (with a reason if not), signed agreements, the last independent audit cover page, internal audits and carved-out Medicaid BIN/PCN lists.[3] | Contracts, TPA reports, independent auditor |
| 7 | Shipping addresses | Any receiving location that isn’t a registered site or contract pharmacy, what it does, and license and ownership proof for pharmacies.[3] | Pharmacy operations |
| 8 | Self-disclosures | Copies of any self-disclosures sent to HRSA since the start of the sample period.[3] | Compliance |
| 9 | Medicaid billing | For carve-in sites and pharmacies, the states and billing numbers used, one fee-for-service claim per state, and each state’s 340B billing rules.[3] | Billing office, pharmacy claims |
| 10 | Combined purchasing and distribution model | Only if you have an approved or pending model: purchaser and receivers by 340B ID.[3] | Grantee leadership |
| 11 | Previous audit CAP | How you sized prior noncompliance, letters and settlements with manufacturers, and ongoing monitoring.[3] | Compliance |
The 340B universe your TPA has to export
Section 3 is the backbone of the audit, because the sample is drawn from it. The sample DRL names the TPA as a typical source system for entity-owned and contract pharmacy data, and asks for these fields on every line.[3]
- aPatient ID (medical record or prescription number)
- bLocation: ordering or administering site, and the dispensing pharmacy
- cDate written or ordered (time too for hospital-administered drugs)
- dDate dispensed or administered (time too for hospital-administered drugs)
- eDrug name
- fNDC
- gQuantity
- hOrdering provider
- iEvery payer: primary, secondary and tertiary, including Medicaid
- jPurchase account type, account and 340B ID
- kAcquisition price
Include unreplenished units
With virtual inventory, the universe should include every administration or dispense designated as 340B, whether or not it has been replenished yet. A report filtered to replenished claims comes up short.[3]
Explain how it was built
For each universe, name the system and report, note exclusions such as reversed transactions, and add a crosswalk that explains every column header.[3]
Be ready to drill in
For each sampled line, auditors want the full record. The DRL asks for someone who can navigate the EHR, billing and the split-billing or third-party software during the audit.[3]
Mixed-use hospital pharmacy? See 340B accumulators and split billing, explained.
What auditors keep finding
HRSA posts each audit’s findings, sanctions and corrective action status. The FY25 results repeat the same patterns, in HRSA’s own wording. GPO findings appear too, but less often.[7]
Incorrect 340B OPAIS record
- Offsite outpatient facilities or grant sites not listed
- Contract pharmacies still registered without a written contract, or duplicate registrations
- Out-of-date Medicare cost report dates, shipping addresses or contacts
Source[7]
Diversion
- 340B drugs dispensed at contract pharmacies for prescriptions written at ineligible sites
- The same at the entity’s own pharmacy
- 340B drugs dispensed to inpatients
Source[7]
Duplicate discounts
- Inaccurate or incomplete information on the Medicaid Exclusion File
- Billing Medicaid while not listed on the Medicaid Exclusion File
- A contract pharmacy billing Medicaid without notice to HRSA
Source[7]
The usual sanctions are repayment to manufacturers and termination of the cited contract pharmacy or site from the program. In some Medicaid Exclusion File cases, HRSA noted that the state later determined no duplicate discount occurred.[7]
What to do now, at notice, and when the sample lands
Before you’re selected
- Review OPAIS for every site, contract pharmacy and shipping address, and confirm it at annual recertification.[1][7]
- Run quarterly internal audits and an annual independent audit of each contract pharmacy you use.[6]
- Reconcile dispensing, purchasing and billing records, and keep written oversight procedures.[6]
- Keep documents in folders that mirror the 11 DRL sections, all year.[3][8]
- Ask your TPA for a test 340B universe export and check it against the DRL fields.[3]
When the letter arrives
- Give every DRL item an owner, a source system and a due date.[8]
- Document how each universe was built: system, report name, exclusions and reversals.[3]
- Strip patient names, birth dates and addresses from uploads to the secure workspace.[3]
- Line up the provider list, invoices per account and contract pharmacy agreements.[3]
When the sample arrives
- Pull credentialing proof for every provider in the sample.[3][8]
- Ask pharmacies for copies of sampled prescriptions; contract pharmacy samples may show only an Rx number.[8]
- Walk through each claim in the EHR and in the TPA or split-billing software ahead of time.[3][8]
- Have someone who can navigate those systems, including billing, ready for audit day.[3]
The covered entity stays responsible for compliance at its contract pharmacies, even when a TPA runs the data.[6] How contract pharmacy setup works with a 340B TPA
Audit-ready records from day one
Independent TPA
Aventi runs contract pharmacy and split billing for 300 covered entities, 24 of them hospitals.
Every claim audit-ready
We capture eligible claims across a 10,000+ pharmacy network in real time, apply eligibility matching, and keep the claim-level history auditors ask to see.
A person, not a ticket queue
A dedicated account manager helps you pull universe reports and sampled claims when the Data Request List arrives.
Ready for 2027
The rebate module is Included for Aventi TPA clients. Learn about the 340B rebate model, or compare 340B TPAs.
HRSA 340B audits: common questions
Sources
- HRSA Office of Pharmacy Affairs, Program Integrity (covered entity audit scope, process, notice and hearing, CAP and repayment) — https://www.hrsa.gov/opa/program-integrity
- 42 U.S.C. § 256b, Limitation on prices of drugs purchased by covered entities: (a)(4)(L), (a)(5)(A)–(C) and (d)(2)(B) (Cornell LII) — https://www.law.cornell.edu/uscode/text/42/256b
- 340B Prime Vendor Program (Apexus), Sample HRSA 340B Audit Data Request List (DRL) for Covered Entities (updated Sept. 10, 2026) — https://www.340bpvp.com/Documents/Public/340B%20Tools/sample-hrsa-340b-audit-data-request-for-covered-entities.pdf
- 340B University, FY27 Update: HRSA 340B Audit Data Request List (DRL) — https://www.340bpvp.com/340b-university/virtual-events/fy27-update-hrsa-340b-audit-data-request-list-drl
- Apexus, Essential Practices for HRSA Audit Preparedness (published in 340B Report, Oct. 13, 2023) — https://www.apexus.com/about-us/articles-and-updates/essential-practices-for-hrsa-audit-preparedness
- HRSA FAQ, What are the audit and compliance parameters under the contract pharmacy guidelines? — https://www.hrsa.gov/about/faqs/what-are-audit-compliance-parameters-under-contract-pharmacy-guidelines
- HRSA, Program Integrity: FY25 Audit Results (updated Oct. 30, 2026) — https://www.hrsa.gov/opa/program-integrity/fy-25-audit-results
- RxTrail, The Data Request List Is Big. A Good Checklist Makes It Manageable. (Oct. 26, 2026) — https://www.rxtrail.com/post/the-data-request-list-is-big-a-good-checklist-makes-it-manageable
Last updated November 13, 2026. This page is general information, not legal advice. Your audit follows the engagement letter and data request HRSA sends you.